Re: [PATCH v6 2/4] x86/modules: Increase randomization for modules

[Edgecombe, Rick P]

On Fri, 2018-09-21 at 12:05 -0700, Kees Cook wrote:
> On Thu, Sep 13, 2018 at 2:31 PM, Rick Edgecombe
> <rick.p.edgecombe@xxxxxxxxx> wrote:
> I would find this much more readable as:
> static unsigned long get_module_vmalloc_start(void)
> {
> ÂÂÂÂÂÂÂunsigned long addr = MODULES_VADDR;
> 
> ÂÂÂÂÂÂÂif (kaslr_randomize_base())
> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂaddr += get_module_load_offset();
> 
> ÂÂÂÂÂÂÂif (kaslr_randomize_each_module())
> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂaddr += get_modules_rand_len();
> 
> ÂÂÂÂÂÂÂreturn addr;
> }
Thanks, that looks better.

> 
> > Âvoid *module_alloc(unsigned long size)
> > Â{
> > @@ -84,16 +201,18 @@ void *module_alloc(unsigned long size)
> > ÂÂÂÂÂÂÂÂif (PAGE_ALIGN(size) > MODULES_LEN)
> > ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂreturn NULL;
> > 
> > -ÂÂÂÂÂÂÂp = __vmalloc_node_range(size, MODULE_ALIGN,
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂMODULES_VADDR +
> > get_module_load_offset(),
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂMODULES_END, GFP_KERNEL,
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂPAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ__builtin_return_address(0));
> > +ÂÂÂÂÂÂÂp = try_module_randomize_each(size);
> > +
> > +ÂÂÂÂÂÂÂif (!p)
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂp = __vmalloc_node_range(size, MODULE_ALIGN,
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂget_module_vmalloc_start(), MODULES_END,
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂGFP_KERNEL, PAGE_KERNEL_EXEC, 0,
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂNUMA_NO_NODE, __builtin_return_address(0));
> Instead of having two open-coded __vmalloc_node_range() calls left in
> this after the change, can this be done in terms of a call to
> try_module_alloc() instead? I see they're slightly different, but it
> might be nice for making the two paths share more code.
Not sure what you mean. Across the whole change, there is one call
toÂ__vmalloc_node_range, and one toÂ__vmalloc_node_try_addr.